Mmm... Ok, i had to use a similar approach for translations, we should add an auth method that doesn't rely on http headers somewhere so that we don't duplicate code or add support for passing auth parameters as query parameter (but that wouldn't work for translations when serving the index jade file)